Get a paginated set of alerts
https://{kibana_url}
- GET /api/alerts/alerts/_find
- GET /s/{space_id}/api/alerts/alerts/_find
Refer to Spaces for more information.
Deprecated in 7.13.0. Use the find rules API instead. NOTE: Alert params are stored as a flattened field type and analyzed as keywords. As alerts change in Kibana, the results on each page of the response also change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data.
Query Parameters
-
default_search_operatorstring · default: OR The default operator to use for the
simple_query_string.-
fieldsstring The fields to return in the
attributeskey of the response.-
filterstring A KQL string that you filter with an attribute from your saved object. It should look like
savedObjectType.attributes.title: "myTitle". However, if you used a direct attribute of a saved object, such asupdatedAt, you must define your filter, for example,savedObjectType.updatedAt > 2018-12-22.-
has_referenceobject Filters the rules that have a relation with the reference objects with a specific type and identifier.
-
pageinteger · default: 1 The page number to return.
-
per_pageinteger · default: 20 The number of alerts to return per page.
-
searchstring An Elasticsearch
simple_query_stringquery that filters the alerts in the response.-
search_fieldsstring | string The fields to perform the
simple_query_stringparsed query against.-
sort_fieldstring Determines which field is used to sort the results. The field must exist in the
attributeskey of the response.
Responses
Indicates a successful call.
-
dataobject -
actionsobject -
alertTypeIdstring -
apiKeyOwnerstringnullable -
createdAtstring -
The date and time that the alert was created.
-
createdBystring -
The identifier for the user that created the alert.
-
enabledboolean -
Indicates whether the alert is currently enabled.
-
executionStatusobject -
lastExecutionDatestring -
statusstring -
idstring -
The identifier for the alert.
-
muteAllboolean -
mutedInstanceIdsstringnullable -
namestring -
The name of the alert.
-
notifyWhenstring -
paramsobject -
scheduledTaskIdstring -
throttlestringnullable -
updatedAtstring -
updatedBystringnullable -
The identifier for the user that updated this alert most recently.
-
pageinteger -
perPageinteger -
totalinteger
Authorization information is missing or invalid.
-
error -
Values:
Unauthorized -
messagestring -
statusCode -
Values:
401